

CLAIMS 



What is claimed is: 



1. 



A method of protecting and executing executable files, the method con^rising: 



protecting an executable file through either of compression and encryption; 

incorporating a protection descriptor into said executable file, said protection 
descriptor including information required for unprotecting said executable file; 

providing said protected executable file to vmprotection and execution apparatus 
operative to unprotect said executable file; 

unprotecting said protected executable file at said unprotection and execution 
apparatus using said protection descriptor; and 

executing said unprotected executable file at said unprotection and execution 

apparatus. 

2. A method according to claim 1 wherein said incorporating step comprises 
including either of a compression key and an encryption key required to uncompress or 
decrypt said protected executable file in said protection descriptor. 

3. A method according to claim 1 and fiirther comprising encrypting said 
protection descriptor, 

4. A method according to claim 1 wherein said providing step comprises providing 
said protected executable file to an interpreter. 

5. A method according to claim 4 wherein said executable file is an ELF 
executable file and wherein said interpreter is an ELF interpreter. 

6. A method according to claim 4 wherein said improtecting step fiirther comprises 
checking said protected executable file for the presence of non-standard program code and 
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unprotecting said protected executable file only when said non-standard program code is 
present in said protected executable file. 

7. A method according to claim 1 wherein said providing step con^rises providing 
said protected executable file to a kernel module. 

8. A method of protecting and executing executable files, the method comprising: 
protecting at least one fimction within an executable file through either of 

compression and encryption, thereby creating a protected portion corresponding to said at 
least one fimction; 

preceding said protected portion with a fimction call instruction to a dynamic 
improtector; 

executing said fimction call instruction, thereby executing said dynamic 
unprotector; 

unprotecting, at said dynamic unprotector, said protected portion, thereby 
creating an unprotected portion; 

overwriting said fimction call instruction and said protected portion with said 
xmprotected portion; and 

executing said unprotected portion. 

9. A method according to claim 8 and fiirther comprising incorporating into said 
executable file a list identifying said protected fimction, said list describing any of the 
fimction length of said fimction, the compression method used to protect said fimction, the 
encryption method used to protect said fimction, and a key required to unprotect said 
protected portion, wherein said improtecting step comprises unprotecting using any 
information in said list. 

10. A method according to claim 8 and fiirther comprising providing said 
executable file to unprotection and execution apparatus, and wherein said executing, 
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iinprotecting, and overwriting steps are performed by said improtection and execution 
apparatus. 

11. A method according to claim 10 wherein said protecting step comprises 
protecting said at least one fimction within an executable file, and wherein said providing 
step comprises providing said executable file to an interpreter. 

12. A method according to claim 11 wherein said executable file is an ELF 
executable file and wherein said interpreter is an ELF interpreter. 

13. A method of protecting and executing executable files, the method comprising: 
hashing at least one static portion of an executable file, thereby creating a 

cryptographic digest; 

encrypting, using said cryptographic digest, at least one execution parameter 
necessary for the execution of said executable file; 

storing said encrypted execution parameter in said executable file; 

hashing said at least one static portion of said executable file, thereby recreating 
said cryptographic digest; 

decrypting, using said cryptographic digest, said at least one encrypted 
execution parameter; and 

executing said executable file using said decrypted execution parameter, 

14. A method according to claim 13 wherein said encrypting step comprises 
encrypting the address of an instruction that represents the entry point for execution of said 
executable file. 

15. A method according to claim 13 wherein said first hashing, encrypting, and 
storing steps are performed on a first computer, and wherein said second hashing, 
decrypting, and executing steps are performed on a second computer. 
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16. A method according to claim 13 and further comprising providing said 
executable file to unprotection and execution apparatus, and wherein said first hashing, 
encrypting, and storing steps are performed by said unprotection and execution apparatus. 

17. A method according to claim 16 wherein said first hashing, encrypting, and 
storing steps are performed on an executable file, and wherein said providing step comprises 
providing said executable file to an interpreter. 

18. A method according to claim 17 wherein said executable file is an ELF 
executable file and wherein said interpreter is an ELF interpreter. 
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